A recent work of [1]} suggests that the most effective data augmentations are those which are perceptually similar to the target corruptions from CIFAR-10-C and ImageNet-C.
Along the same lines, [2]} mention that for AugMix, there is a visual similarity, e.g., between the posterize operation and the JPEG corruption.
Thus, to prevent training on augmentations which resemble the ones from CIFAR-10-C and ImageNet-C, we use only random horizontal flip and random crops unless mentioned otherwise.
Moreover, when we train Fast PAT on CIFAR-10, we make sure to remove the overlapping augmentations used in the robustness library [3]} such as random brightness and contrast change.
For the experiments whose results are reported in Table REF , we use additional augmentations like AugMix, SIN, ANT3x3 whenever it is explicitly mentioned.
